Braze emails can now include a Magic Link that logs a supporter straight into a pre-built cart, so they can complete a purchase without signing in first. If they then try to do anything that needs full account access, they're simply prompted to log in properly at that point.
Why this matters
Previously, a supporter clicking a purchase link in a marketing email still had to log in before they could buy an extra step between intent and conversion. This feature removes that step for the purchase itself, while keeping full account access properly gated behind a login.
What's new
One-click access to a pre-built cart
A Magic Link generated in Braze logs the supporter in and creates the specified cart item automatically. They land straight on the cart page, ready to check out with a new or existing payment method.
Limited access by design
The login created from a Magic Link uses a "limited" access level, enough to complete that one purchase, not full account access. Supporters can view their purchase receipt and ticket, though some account details stay hidden at this access level.
Stepping up to full access
If a supporter tries to visit a page that needs standard access My Account, for example they're shown a login prompt. Logging in there steps them up to full access for the rest of their session. If they close the prompt instead, they stay logged in at the limited level and return to where they were.
Optional 2FA on step-up
Where two-factor authentication is enabled and set up on the supporter's account, stepping up to full access can also require a 2FA code, sent by email or generated through an authenticator app.
Built-in safeguards
- Magic Links are single-use, reusing one still adds the cart item, but won't log the supporter in again
- Links expire automatically (24 hours by default)
- A link won't log in a supporter whose account is locked or deactivated
Who this impacts
Any operator using Braze to drive ticket purchases from marketing or lifecycle emails.
Admin setup
The core configuration is enabled in both Sandbox and Production:
LIMITED_CUSTOMER_AUTH.enabled- turns on autologin token generationLIMITED_CUSTOMER_AUTH.autologin_token_timeout- sets how long a link stays valid before it expires (default: 86400 seconds / 24 hours)LIMITED_CUSTOMER_AUTH.session_timeout- sets how long the resulting session lasts (default: 7776000 seconds / 90 days)ELEVATION_REQUIRED.enabledandELEVATION_REQUIRED.api_endpoints- control which parts of the platform require limited, standard, elevated, or always-2FA access
These can be reviewed or adjusted under Admin > Operations > Platform configs > Site config > Limited Customer Authentication and Admin > Operations > Platform configs > Fraud config > Elevation Required.
Note: To use the optional 2FA step-up flow, the Two Factor Authentication system email must be enabled under Admin > Marketing > Emails > System emails.
To set up a test template in Braze, reach out to your Customer Success Manager.